DeepSeek Integration

Add governance to DeepSeek API calls. Control Zero intercepts requests through the Governance Gateway and enforces your dashboard policies on every interaction.

Overview

DeepSeek provides reasoning and coding models via an OpenAI-compatible API. When routed through the Control Zero Governance Gateway, every request is governed by your policies and logged for audit.

DeepSeek uses the OpenAI-compatible wire format, so the integration reuses the same interceptors and policy enforcement as the OpenAI integration.

Setup

1. Configure the Gateway

Enable the DeepSeek provider in your Governance Gateway configuration:

# Environment variables for the gateway
CZ_GATEWAY_DEEPSEEK_ENABLED=true
CZ_GATEWAY_DEEPSEEK_API_KEY=your_deepseek_api_key

2. Route Requests Through the Gateway

Point your client at the gateway's DeepSeek endpoint:

import openai

# Route through Control Zero gateway instead of direct DeepSeek
client = openai.OpenAI(
    base_url="http://localhost:8000/deepseek",
    api_key="cz_live_your_key_here",
)

response = client.chat.completions.create(
    model="deepseek-chat",
    messages=[{"role": "user", "content": "Explain the CAP theorem in distributed systems."}],
)
print(response.choices[0].message.content)

3. Define Policies

Create policies in the dashboard to govern DeepSeek usage:

{
  "name": "deepseek-usage-policy",
  "rules": [
    {
      "effect": "allow",
      "action": "llm:chat.completions",
      "resource": "deepseek/*",
      "conditions": { "model": ["deepseek-chat", "deepseek-coder"] }
    },
    {
      "effect": "deny",
      "action": "llm:chat.completions",
      "resource": "deepseek/*",
      "conditions": { "max_tokens_gt": 8192 }
    }
  ]
}

What Gets Governed

API Endpoint	Policy Action	Description
POST /deepseek/chat/completions	llm:chat.completions	Chat completions (streaming and non-streaming)
POST /deepseek/completions	llm:completions	Text completions
GET /deepseek/models	llm:models.list	Model listing

Streaming Support

The gateway fully supports streaming responses from DeepSeek. Server-sent events are forwarded transparently while policy enforcement and audit logging occur on the initial request.

Tool Call Governance

DeepSeek models that support tool use (function calling) are fully governed. The gateway intercepts tool call responses and evaluates each tool invocation against your policies before forwarding to the client.

{
  "name": "deepseek-tool-restrictions",
  "rules": [
    {
      "effect": "allow",
      "action": "mcp.tool.call",
      "resource": "mcp://filesystem/read_file"
    },
    {
      "effect": "deny",
      "action": "mcp.tool.call",
      "resource": "mcp://filesystem/write_file"
    }
  ]
}

Audit Logging

All DeepSeek requests routed through the gateway are logged in the audit trail with the provider identified as deepseek. View them in the dashboard under Audit Log with the provider filter.

Related

• OpenAI Integration: Same wire format, same governance patterns.
• Ollama Integration: Another OpenAI-compatible provider (local models).
• Anthropic Integration: Anthropic Claude integration.
• API Reference: Full API documentation.